Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
This past Saturday, a hacker took over NYU's website for at least two hours and exposed the personal data of over 3M applicants in an act of hacktivism. The leaked data included names, test scores, majors, zip codes, financial data, and information on applicants' family members dating back to at least 1989. The hacker claimed to have breached NYU to expose its continued use of affirmative action after the 2023 SCOTUS ruling.
Defensive tools that use command-line arguments to detect malicious activity are vulnerable to a technique called ArgFuscator. Obfuscation can exploit parsing flaws in executables to evade security detections, highlighting weaknesses in current cybersecurity methods.
Microsoft's Time Travel Debugging (TTD) framework is a powerful record-and-replay tool that uses CPU instruction emulation to replay program execution. Google's Mandiant team found a bug in the emulation engine and built a fuzzing harness to execute random instruction sequences through TTD and a real CPU, discovering three bugs in the process, which they reported to Microsoft.
This tutorial demonstrates how to unpack a modified UPX-packed executable using TinyTracer and PE-sieve tools, which avoids anti-debugging measures common in packed malware. The process involves first tracing the executable to identify its Original Entry Point (OEP), setting a stop offset in TinyTracer to pause execution at the OEP, then using HollowsHunter to dump and reconstruct the unpacked program with its Import Address Table. After dumping, final modifications are needed in PE-bear to fix the entry point and restore proper section characteristics for the executable to run successfully.
Sponsored
Are your security controls in fighting shape against today's threats? You don't have to guess. Prelude monitors and validates your security controls [11] - evaluating your full estate of devices (with no agents required), surfacing missing and suboptimal controls, ensuring best practices are in place, and alerting you on configuration drift. Start
Twistr is a domain name permutation and enumeration library powered by Rust. It aims to directly port the well-known dnstwist tool allowing for fast and flexible interfacing capabilities with the core libraries based on the client's requirements.
Microsoft is expanding Security Copilot with 11 AI agents across its security platform. Six Microsoft-built and five partner-developed agents will help automate cybersecurity tasks like phishing triage, threat intelligence, and vulnerability management, aiming to combat the growing complexity of cyber threats.
Bounty Prompt is a Burp Suite extension that allows users to save preconfigured AI prompts and automatically attach selected HTTP requests and responses.
Albabat ransomware is evolving to target Windows, Linux, and macOS platforms. Retrieving components from a GitHub repository, it now harvests system information, encrypts files across multiple operating systems, and tracks infections in a PostgreSQL database.
This post compares DryRun Security's contextual scanner to Snyk Code, GitHub Advanced Security, Semgrep, and SonarQube in finding vulnerabilities in the intentionally vulnerable RailsGoat. The test PR included SQL injection, XSS, SSRF, IDOR, user enumeration, and hardcoded token vulnerabilities. DryRun was the only tool that found all the vulnerabilities, whereas Semgrep found 3/6, GitHub and Snyk found 2/6, and SonarQube found none.
The UK's NCSC aims to adopt post-quantum cryptography (PQC) by 2035, with key milestones including completing discovery and planning by 2028 and high-priority migrations by 2031.
China-linked APT Weaver Ant infiltrated an Asian telecom provider's network for over four years, using web shells for persistence and stealthy control of compromised systems.
23andMe filed for bankruptcy and will sell its assets - customers should delete their DNA data for privacy.
Sponsored
* How can you protect commonly exploited ports and services? * Which policies do you need to have in place to get started? * How can you build a multi-layered approach to securing your servers?
Hellcat has claimed the attacks on Ascom and Jaguar Land Rover (JLR). It stole 44GB of sensitive data from Ascom's ticketing system and hundreds of gigabytes from JLR. Ascom confirmed the attack, while JLR hasn't responded.
Operation Zero, a Russian exploit broker, offers up to $4 million for Telegram zero-day exploits exclusively to the Russian government and local firms. Payouts vary: $500,000 for one-click RCE, $1.5 million for zero-click RCE, and $4 million for a full chain of exploits.
Cisco Smart Licensing Utility (CSLU) is a Windows application that allows admins to manage licenses and linked products on-prem without connecting them to Cisco's cloud licensing software. In September, Cisco patched a vulnerability that exposed an undocumented, static credential for a built-in admin account and allowed unauthenticated users to access log files containing sensitive data. SANS' Dean of Research reports that threat actors are now chaining these two vulnerabilities to exploit internet-exposed CSLU instances.
Google has acquired cloud security startup Wiz for $32 billion, its most expensive purchase ever. This move aims to strengthen Google Cloud against rivals Microsoft and Amazon, whose cloud services generate significantly more revenue.
Tenable's 2025 report revealed that most organizations deploy AI services in cloud environments with dangerous default configurations, with 91% enabling root access in Amazon SageMaker. This "Jenga-like" approach, where compromising one service affects all connected services, mirrors early cloud deployment mistakes.
The Splunk Threat Research Team identified a new campaign targeting ISP infrastructure. Attackers use weak credentials to gain initial access, downloading malware from a C2 server that runs a crypto miner and an infostealer to detect crypto wallet passphrases and take screenshots. They establish persistence and pivot to additional IP CIDRs, utilizing Python and Powershell scripts to maintain a minimal presence, including IoCs in the post.
* An overview of IT and cybersecurity risk management. * Why you need risk management. * How to make risk management work for your organization.
Sponsored
Cyber incidents—ransomware attacks, data breaches, and IT disruptions—topped the Allianz Risk Barometer for the third time in the survey's history in 2024. Companies have to manage these risks, and the costs of a miscalculation can be catastrophic.
SentryPeer is a fraud detection tool that tracks bad actors' attempted calls by saving their IP addresses and dialed numbers.
Faction is a Pen Test Report Generation and Assessment Collaboration tool that helps automate pen testing and security assessment reports.
shadow-rs is a Windows kernel rootkit written in Rust that includes advanced kernel manipulation techniques.
Targeting illegal football streaming, Italy's court has ordered Google to block pirate websites at the DNS level under its Piracy Shield law. Meanwhile, critics call the approach draconian due to collateral damage like accidentally blocking entire domains.
The tj-actions and xz utils supply chain attacks have highlighted the issues that exist in establishing a maintainer's identity on GitHub. GitHub should require certain security features on a repository once it hits a certain popularity threshold, such as signed commits, PRs, blocking force pushes with an emergency override system, and 2FA for all admin credentials and maintainers. It should create an opt-in standard for verifying open-source maintainer identities, managing roster changes, and maintaining public audit logs and security settings. GitHub could also implement a production version of Chainguard's octo-sts for short-lived runner credentials and check for typosquatting in GitHub Actions.
Ex-NFL coach Matt Weiss has been charged with hacking college athletes' accounts and college databases to obtain intimate photos.
Hackers from six nations have exploited a Windows zero-day vulnerability in .lnk files since 2017, targeting over 300 organizations for espionage and data theft.
Two harmful VSCode extensions, "ahban.shiba" and "ahban.cychelloworld," deployed an early ransomware, exposed flaws in Microsoft's review process.
Sponsored
A new report by Obsidian Security reveals a massive spike in YoY data breaches. In 99% of analyzed breaches, the initial target was the Identity Provider (IdP).
California Cryobank, one of the largest reproductive tissue banks in the world, has disclosed a data breach affecting an undisclosed number of Americans. The hackers potentially stole data that includes SSNs, driver's license numbers, financial account numbers, and health insurance information. No known threat actor has claimed responsibility for the attack.
MegaRAC BMC software enables remote server management, allowing admins to troubleshoot as if present. Eclypsium researchers identified a CVSS 10 vulnerability permitting remote, unauthenticated attackers to control affected servers. AMI, the software's developer, has issued patches to OEM manufacturers for customer rollout.
VMware has released patches for three zero-day vulnerabilities in ESXi, allowing threat actors to escape the hypervisor and access critical server data. The vulnerabilities are actively being exploited in the wild, posing a significant risk to organizations using VMware environments. It is crucial to patch affected systems promptly to prevent potential security breaches.
Researchers from Pillar Security have discovered a new prompt injection technique on Cursor and GitHub Copilot. These systems use rules files to guide the prompting for the LLM, which is often distributed by open-source projects or from other untrusted locations. The attack involves utilizing invisible Unicode characters to hide malicious instructions for the LLM that can be used to instruct it to poison the generated code.
This post outlines seven security flywheels: reducing costs to raise security baselines, transitioning threat intelligence from push to pull, creating digital twins through asset inventory, enhancing detection via red teaming, identifying adjacent business benefits of security measures, implementing continuous control monitoring, and forming federated teams that seek assistance instead of pushing initiatives. Each flywheel creates a cycle where initial investments yield benefits that can be reinvested, ultimately easing the burden on security teams while sustaining or improving security posture.
Attackers can bypass Windows Defender Application Control with LOLBINs and Electron apps using tools like Loki C2. Modifying JavaScript in trusted Electron apps enables Node.js code injection to interact with the OS, allowing the execution of malicious payloads and the creation of advanced C2 agents like Dragon.
AWS IAM Policy Visualizer is a web app that visualizes the relations in an IAM policy in graph format. The tool also provides a search function for large policies.
cvss-bt enriches the NVD CVSS scores to include Temporal/Threat Metrics.
StringReaper extracts strings, such as JWT tokens and credentials, from remote process memory, saving time in engagements. It can filter memory regions and includes features like listing target sections and displaying remote environment strings.
A researcher released an open-source decryptor for Akira ransomware that brute forces encryption keys. Akira generates unique keys for each file using four timestamp seeds, hashes them through 1,500 rounds, and encrypts them with another key, appending them at the end of each file. The researcher analyzed logs to estimate when the ransomware was active and used 16 4090s via RunPod & Vast.ai to decrypt a friend's files in 10 hours.
With Check Point and Palo Alto exiting CNAPP, the field has consolidated around Wiz and a few leaders, losing much of its previous hype. CNAPP tools will revert to their components: CSPM for vulnerability management, ASPM for secure code development, and CADR for responding to cloud alerts.
A malware campaign called 'DollyWay' has compromised over 20,000 WordPress sites globally, redirecting users to harmful sites since 2016. The campaign has evolved to include advanced evasion techniques and monetization strategies. GoDaddy researchers have linked this operation to a larger scam redirection system named 'DollyWay World Domination.'
A federal appeals court has decided that Capital One hacker Paige Thompson's sentence was too lenient for stealing data from millions of customers, and the case is now going back to the district court for resentencing.